Is it necessary to validate a SAML Assertion

I, as a service provider, am trying to authenticate a user on my page by getting a SAML Assertion (SAML 1.0) from the identity provider (IdP). The following steps are performed (very abstract):

1. User visits my page
2. I redirect the user to the IdP where the user authenticates
3. I get a SAML Artifact with which I request the SAML Assertion from the IdP
4. The IdP sends the SAML Assertion directly back to my page
5. ?

Is this process enough to ensure, that the users authentication is legit? Do I just grant the user access to my service in step 5 or do I have to make sure, that the SAML Assertion is valid, by verifying the signature in the Assertion? If so, how do I do that? Do I miss any other steps?